Legal
Retention matrix
How long each data category is retained, why, and what triggers deletion. Source of truth: docs/legal/retention-matrix.md.
| Category | Retention | Purpose | Delete on |
|---|---|---|---|
| Forecast runs | 2 years (default plan) · 7 years (enterprise) | Reproducibility, benchmark integrity | Tenant delete request · plan downgrade |
| Audit events | 7 years (hash-chained, immutable) | Compliance evidence (SOC2 / GDPR / regulatory) | Never — immutable during retention window |
| API request logs | 180 days | Rate limit + abuse detection, debugging | Rolling purge |
| Series data (BYO upload) | Indefinite (tenant-controlled) | Feature store for forecasts | Tenant delete request |
| Team invitations / magic links | Until used or expired; purged a day after expiry | Onboarding and sign-in | Daily purge · account erasure |
| Billing invoices | 7 years (legal minimum) | Tax + audit | After legal minimum · a deleted personal workspace's subscriptions are cancelled on account erasure |
| Trial-used record | Indefinite | One free trial per person (abuse prevention, legitimate interest) | Never — kept through account erasure; holds a pseudonymous id, never your email |
| Internal event queue | Indefinite (no scheduled purge) | Reliable delivery of workspace events and webhooks | Account erasure (events naming a deleted personal workspace) |
Data-subject access rights
Anyone with an account can exercise their rights from Account → Privacy: download the personal data we hold (access and portability), set consent, and delete their account (erasure). Through the API:
POST /v1/privacy/data-export with {"scope": "me"}, PUT /v1/privacy/consent and POST /v1/privacy/delete. A workspace admin can also export the whole workspace's data ({"scope": "tenant"}).What deleting an account removes
Your sign-in and identity data: sessions, sign-in links, passkeys, consent choices, memberships, invitations addressed to you, your personal data exports, and the API keys of a workspace only you belonged to. Your personal workspace — the one created when you signed up — is deleted with all its data if you were its only member, and its active subscription is cancelled. Signing up again with the same email gives you a new, empty workspace: you are not put back into a workspace kept for its other members, and the free trial is not granted a second time (we keep a pseudonymous record, not your email, that you had it). Every other workspace keeps its data, even if you were its last member: it belongs to that organisation. Where your email merely names you on a record a workspace keeps — the workspace's name, an invitation you sent, an attribution — it is replaced with a pseudonym. The audit log stays: it is tamper-evident, so it cannot be edited, and it is kept for seven years as a security record. Billing records are kept as tax law requires.
GET /v1/privacy/delete/{id} reports what was removed, and lists any step still finishing after the request is completed in pending_stages.